Filtering email messages corresponding to undesirable domains

ABSTRACT

An email message is filtered to determine whether or not it is an undesired email message (e.g., “spam,” “junk mail,” etc.) that originates from an undesirable domain, such as, for example, a domain designated as originating from an undesirable geographic location. In some embodiments, upon determining that the email message originates from an undesirable domain, the email message is deleted (e.g., permanently removed, moved to a designated folder, marked for followup, etc.). In other embodiments, upon determining that the email message originates from an undesirable domain, the email message is further filtered to determine whether or not the email message includes attributes that indicate that the email message should not be discarded.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of application Ser. No. 10/610,736,filed on Jun. 30, 2003, now U.S. Pat. No. 7,155,484 of which is entirelyincorporated herein by reference.

FIELD OF THE INVENTION

The present disclosure relates generally to digital communication and,more particularly, to email.

BACKGROUND

With the advent of the Internet, email has become prevalent in digitalcommunications. For example, email messages are exchanged on a dailybasis to conduct business, to maintain personal contacts, to send andreceive files, etc. Unfortunately, undesired email messages have alsobecome prevalent with increased email traffic. Often, these emailmessages are unsolicited advertisements, which are often referred to as“junk mail” or “spam.” Currently, software applications exist, whichremove some of the spam or junk mail from a recipient's email account,thereby reducing clutter in the recipient's email account. Some of theseapplications remove email messages that contain a particular text orcontent (e.g., large image files, etc.) that may indicate that the emailmessage is spam or junk mail. Email messages that are determined to bespam or junk mail are then either removed (e.g., permanently deleted) orstored in a designated folder (e.g., “trash” folder, “junk mail” folder,etc.). Unfortunately, some of the algorithms used to detect spam or junkmail may be quite complicated and cumbersome. Due to the complexity ofcurrent anti-spam or anti-junk-mail algorithms, a need exists in theindustry for simpler solutions.

SUMMARY

The present disclosure provides for filtering email messages originatingfrom undesirable domains, such as, for example, addresses associatedwith designated geographical areas.

In this regard, one embodiment comprises receiving an email messagehaving an originating IP address, extracting the originating IP addressfrom the email message, and comparing the originating IP address to alist of undesirable IP addresses. The comparison results in adetermination of whether or not the extracted email address is includedin the list of undesirable IP addresses.

Systems, methods, features, and advantages will be or become apparent toone with skill in the art upon examination of the following drawings anddetailed description.

BRIEF DESCRIPTION OF THE DRAWINGS

Many aspects of the disclosure can be better understood with referenceto the following drawings. The components in the drawings are notnecessarily to scale, emphasis instead being placed upon clearlyillustrating the principles of the present invention. Moreover, in thedrawings, like reference numerals designate corresponding partsthroughout the several views.

FIG. 1A is a block diagram showing an embodiment of an emailenvironment.

FIG. 1B is a block diagram showing an embodiment of an email applicationthat filters email messages.

FIG. 2A is a diagram showing an embodiment of an email read windowhaving an undesired email message.

FIG. 2B is a diagram showing an embodiment of an email header having anundesirable originating Internet protocol (IP) address and other emailattributes.

FIG. 3 is a flowchart showing an embodiment of a method for filteringemail messages.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Reference is now made in detail to the description of the embodiments asillustrated in the drawings. While several embodiments are described inconnection with these drawings, there is no intent to limit theinvention to the embodiment or embodiments disclosed herein. On thecontrary, the intent is to cover all alternatives, modifications, andequivalents.

Increasing email traffic brings a corresponding increase in junk mail orspam. It has now been discovered that much of the spam or junk mailoriginates from certain geographic areas, such as, for example, non-U.S.regions. Hence, by filtering email messages for any indicators thatsuggest an undesired geographic origin, much of the spam or junk mailcan be filtered without the need for cumbersome algorithms that employcomplex heuristics. The disclosed embodiments of the invention providesystems and methods for filtering email messages for indications that anemail message may have originated from a domain located in an undesiredgeographic location. Since a great number of undesired geographiclocations originate in non-U.S. regions, the term “non-U.S.” is usedthroughout this disclosure as shorthand for undesired geographiclocations that originate in non-U.S. regions. In the event that theemail message is determined to originate from a domain from an undesiredgeographic location, the email message may be deleted, moved to adesignated folder, further examined for other email attributes, etc.

FIG. 1A is a block diagram showing an embodiment of an emailenvironment. As shown in FIG. 1A, some embodiments of an email systemcomprise workstations 172, 174, 176 that are coupled to a server 150over a network such as the Internet 180. The server 150 is coupled to adatabase 162 that stores the email accounts (or mailboxes) of varioususers.

In the operating environment shown in FIG. 1A, a sender of an emailmessage generates the email message at a sender workstation 172 andsends the email message through a network 180 to a recipient at arecipient workstation 176. As shown in FIG. 1A, the recipientworkstation 176 includes a processor 182, a network interface 190, amemory 184, a local storage device 188, and a bus 186 that permitscommunication between the various components. While not explicitlyshown, it should be appreciated that the other workstations 172, 174 mayalso include similar components that facilitate computation or executionof applications on the workstations 172, 174. In some embodiments, thelocal storage device 188 may be a hard drive configured toelectronically store data. The local storage device 188 may also storecomputer programs that execute on the recipient workstation 176. In thissense, the processor 182 is configured to access any program that isstored on the local storage device 188, and execute the program with theassistance of the memory 184. In the embodiment of FIG. 1A, an emailapplication 185 is shown as being loaded into memory 184 for launchingat the workstation 176, thereby permitting the workstations 176 to sendand receive email messages through the network 180. Since thefunctioning of computing devices is well known in the art, furtherdiscussion of the processor 182, the memory 184, and the local storagedevice 188 are omitted here. However, it should be appreciated that thememory 184 may be either volatile or non-volatile memory, or acombination thereof.

The network interface 190 is configured to provide an interface betweenthe recipient workstation 176 and the network. Thus, the networkinterface 190 provides the interface for the workstation 176 to receiveany data that may be entering from the network and, also, to transmitany data from the workstation 176 to the network. Specifically, in someembodiments, the network interface 190 is configured to permitcommunication between each of the workstations 172, 174, 176 and theserver 150 and, additionally, to permit communication between theworkstations 172, 174, 176 themselves. In this regard, the networkinterface 190 may be a modem, a network card, or any other interfacethat interfaces each of the workstations 172, 174, 176 to the network.Since various network interfaces are known in the art, furtherdiscussion of these components is omitted here. It should be understoodthat various aspects of the email application 185 may be conventional ormay be custom tailored to specific needs.

Similar to the workstation 176, the server 150 may also include aprocessor 152, a memory 154, a network interface 160, and a local harddrive 158, which are in communication with each other over a local bus156. Since the components 152, 154, 156, 158, 160 at the server 150perform largely similar functions as the components 182, 184, 186, 188,190 at the workstation 176, further discussion of the server-sidecomponents is omitted here.

FIG. 1B is a block diagram showing an embodiment of an email application185 that filters email messages to determine if the email messagesoriginate from a domain located in an undesired geographic location. Asshown in FIG. 1B, the email application 185 is stored in memory 184along with a non-U.S. IP address database 105 and a desired emailattribute database 110. The non-U.S. IP address database 105 includes alist of IP addresses that correspond to domains located in undesiredgeographic locations. For example, if the IP address 211.209.246.93originates from a domain in Korea, then the non-U.S. IP address database105 would list 211.209.246.93 as one of the non-U.S. IP addresses.Similarly, other known non-U.S. IP addresses (or ranges or otheracceptable representations) are included in the non-U.S. IP addressdatabase 105.

The desired email attribute database 110 may include a list of desiredemail attributes. For example, the list of desired email attributes mayinclude a particular sender's name, a specific email address of asender, a specified sender IP address, email content, type of content(e.g., image file, executable file, document, etc.). In other words, thedesired email attribute database 110 may include any detectableattribute or parameter included in an email message. Since emailattributes are known in the art, further discussion of these attributesis omitted here.

The email application 185 comprises a mail store 122, an IP addressextracting filter 112, IP address compare logic 114, an attributeextracting filter 116, attribute compare logic 118, and email deletelogic 120. The mail store 122 stores email messages that are accessibleby a recipient at the workstation 176. In this regard, the mail store122 locally stores all incoming email messages and previously-read emailmessages so that the recipient can readily access the email messagesfrom the workstation 176. Since the retrieval of email messages to theclient from a mail server are known in the art, the process ofretrieving email message for storage at the mail store 122 is notdiscussed herein.

In operation, for some embodiments, when email messages have beenretrieved from the email server and stored at the mail store 122, the IPaddress extracting filter 112 filters the email messages to extract theIP address from which the email message originates. In other words, theIP address extraction filter 112 extracts the originating IP addressesfrom each of the email messages. In some embodiments, this informationis extracted from the header of the email message. In other embodiments,the entire email message is examined to determine the originating IPaddress. In some embodiments, the contents of an email message may beindicative of origin from an undesired geographic region by, forexample, foreign fonts or special characters embedded in the contents ofthe email message. In other embodiments, an embedded hyperlink in thebody of the message may be indicative of origin from an undesiredgeographic region.

Thus, if an email address (e.g., Bobjones@playpen.de) that is associatedwith a foreign country is included in the body, the header, or thereturn address of an email message, then this information may be used todiscern the foreign origin of the email message. Similarly, if a website(e.g., funstuffplaypen.uk) that is associated with a foreign country isreferenced in a hyperlink that is present in an email message, then thatinformation may also be used to discern the non-U.S. origin of the emailmessage. Additionally, other universal resource locators (URLs) andemail addresses also found in non-U.S.-originating email messages may bestored in a database for future reference. Hence, if an email messageoriginating from BobJones@playpen.de, which is a non-U.S. email address,also includes a web address in the body of the email message, such asfreewebhosting.com, then that web address may also be categorized asnon-U.S.-originating, regardless of whether or not freewebhosting.com isa non-U.S.-originating website.

In any event, each originating IP address is conveyed to the IP addresscompare logic 114, which compares the originating IP address to thenon-U.S. IP addresses that are stored in the non-U.S. IP addressdatabase 105. In some embodiments, IP addresses are correlated to adomain located in various geographic locations by accessing a domainname server (DNS) that stores such information. Once an initial set ofIP addresses are correlated to domains and stored in the non-U.S. IPaddress database 105, the database may be updated from time to time withadditional IP addresses that are provided by the user. Alternatively,the additional IP addresses may be provided by the filter itself if thefilter is an adaptive filter. In some embodiments, the IP addresscompare logic 114 may perform a string comparison between theoriginating IP address and each of the undesirable IP addresses in thedatabase 105. The comparison results in a determination of whether ornot the originating IP address is included in the non-U.S. IP addressdatabase 105.

The attribute extracting filter 116 extracts other known attributes fromeach of the email messages. The extracted attributes are conveyed to theattribute compare logic 118, which compares the extracted attributeswith each of the desired email attributes in the desired email attributedatabase 110. The attribute compare logic 118 may perform a stringcomparison between the extracted attributes and the desired emailattributes in the database 110. The comparison results in adetermination of whether or not the email message includes any desiredattributes. Hence, the attribute extracting filter 116, the attributecompare logic 118, and the desired email attribute database 110 worktogether to determine whether or not an email message in the mail store122 is a desired email message, rather than spam or junk mail.

If the IP address compare logic 114 determines that the originating IPaddress of a particular email message is from a domain from an undesiredgeographic location and, additionally, if the attribute compare logic118 determines that none of the extracted attributes of the emailmessage are included in the desired email attribute database 110, thenthe particular email message is conveyed to the email delete logic 120,which deletes the email message. The email message may be deleted bypermanently removing the email message from the mail store 122, movingthe email message to a designated folder (e.g., trash folder), markingthe email message for followup, etc. In other words, if the IP addresscompare logic 114 and the attribute compare logic 118 together determinethat an email message in the mail store 122 is junk mail or spam thatoriginates from a non-U.S. (or otherwise undesirable) domain, then theemail delete logic 120 deletes the email message (e.g., permanentlyremoves the email message, moves the email message to a designatedfolder, marks the email message for followup, etc.).

FIG. 2A is a diagram showing an embodiment of an email read windowhaving an undesired email message. As shown in FIG. 2A, the undesiredemail message originates from a domain “test3.com” that is a knownsource of spam from a particular country, such as, for example, Korea.The header 240 for this email message is shown in FIG. 2B. As shown inFIG. 2B, the email message of FIG. 2A originated from 211.209.246.93,which is a domain from an undesired geographic location 250,specifically a Korea domain. The email message was delivered tojoeface@zzzz.ZZZ.com on Tuesday, May 20, 2003 at 15:13:43 −0400 GMT.Before reaching joeface@zzzz.ZZZ.com, the email message propagatedthrough several hops including utility3.ZZZ.com, having IP addressZZZ.ZZZ.36.202; smtp.ZZZ.com, having IP address ZZZ.ZZZ.36.186;mcafee.ZZZ.com, having IP address ZZZ.ZZZ.36.86; and mail 1.ZZZ.comhaving IP address ZZZ.ZZZ.36.102. As shown in this example, a particularemail message may propagate through several different IP addressesbefore reaching its final destination. In this regard, if any of thehops includes an IP address indicative of a domain from an undesiredgeographic location, then the email application 185 may be configured tofilter and delete those email messages that have propagated through anon-U.S. hop.

In addition to the originating IP address and the various hops, theemail message header 240 of FIG. 2B also contains other attributes. Forexample, the header 240 includes a subject line, which, in this case, isblank; a reply-to email address; a content-type; multipurpose Internetmail extension (MIME) encoding information; and various email-relateddates and times. While not specifically shown in FIG. 2B, it should beappreciated that email messages may contain other attributes such as alist of attachments, type of attachments, and/or other types of knownemail-related attributes.

Some or all of these attributes may be used to determine whether or notthe email message should be deleted. For example, in the embodiment ofFIG. 2B, if the sender's email address “basic4@basic4.com” is includedin the desired email attribute database 110, then, despite originatingfrom a domain from an undesired geographic location, the email messagewill not be deleted because it contains at least one desired attribute.These desired attributes may be used in conjunction with other knownalgorithms that employ known heuristics, thereby providing greaterreliability in spam and junk mail filtering.

As shown from the embodiments of FIGS. 1A through 2B, the non-U.S. IPaddress database 105, in conjunction with the IP address extractingfilter 112 and the IP address compare logic 114, provides an efficientapproach to filtering out a bulk of the junk mail or spam email messagesby segregating email messages that originate from domain from undesiredgeographic locations.

FIG. 3 is a flowchart showing an embodiment of a method for filteringemail messages. As shown in FIG. 3, an embodiment of the method beginswhen an email message is received (310). Upon receiving (310) the emailmessage, an originating IP address is extracted (320) from the received(310) email message. The originating IP address is then compared (330)to a list of non-U.S. IP addresses (e.g., overseas IP addresses). Insome embodiments, the list of non-U.S. IP addresses are stored in adatabase. In other embodiments, the list of non-U.S. IP addresses may bedetermined by accessing known domain-name servers (DNS). In any event,in response to comparing (330) the IP addresses, the system determines(340) whether or not the originating IP address coincides with any ofthe non-U.S. IP addresses. If the originating IP address does notcoincide with any of the non-U.S. IP addresses, then the process ends(399). If, on the other hand, the originating IP address coincides withat least one of the non-U.S. IP addresses, then email attributes arefurther extracted (350) from the email message. The extracted emailattributes are compared (360) to a list of desired email attributes. Insome embodiments, the desired email attributes may be stored in a localdatabase. In other embodiments, the desired email attributes may behard-coded into the email application. In any event, upon comparing(360) the attributes, the system determines (370) whether or not any ofthe extracted email attributes coincides with any of the desired emailattributes. If any of the extracted email attributes coincides with anyof the desired email attributes, then the process terminates (399). If,on the other hand, none of the extracted email attributes coincides withany of the desired email attributes, then the email message is deleted(380), and the process terminates (399). In this regard, the latterportion of the process (steps 350 through 370) provide anexception-based approach that prevents deletion of desired emailmessages, despite their origin from an undesired geographic region.

While specific embodiments of the process are shown in FIG. 3, it shouldbe appreciated that other algorithms may be employed to determineexceptions that prevent deletion of desired email messages. As is knownin the art, these exceptions may be rule-based or may be based onalgorithms employing complex heuristics. Since these rule-basedapproaches for determining exceptions are known in the art, no furtherdiscussion of these approaches is included herein.

As shown in the embodiment of FIG. 3, a process that filters emailmessages to determine whether or not the email message originates from adomain from an undesired geographic location provides an efficientapproach to filtering out junk mail or spam email messages thatoriginate from domains located in undesired geographic locations. Sincemuch of the junk mail or spam originates from domain from undesiredgeographic locations, the filtering of email messages for non-U.S. IPaddresses results in a simple and efficient approach to reducing clutterin email accounts.

The email application, the IP address extracting filter, the IP addresscompare logic, the attribute extracting filter, the attribute comparelogic, the email delete logic, the mail store, the undesired IP addressdatabase, and the desired email attribute database of the presentinvention can be implemented in hardware, software, firmware, or acombination thereof. In the preferred embodiment(s), the emailapplication, the IP address extracting filter, the IP address comparelogic, the attribute extracting filter, the attribute compare logic, theemail delete logic, the mail store, the undesired IP address database,and the desired email attribute database are implemented in software orfirmware that is stored in a memory and that is executed by a suitableinstruction execution system. If implemented in hardware, as in analternative embodiment, the email application, the IP address extractingfilter, the IP address compare logic, the attribute extracting filter,the attribute compare logic, the email delete logic, the mail store, theundesired IP address database, and the desired email attribute databasecan be implemented with any or a combination of the followingtechnologies, which are all well known in the art: a discrete logiccircuit(s) having logic gates for implementing logic functions upon datasignals, an application specific integrated circuit (ASIC) havingappropriate combinational logic gates, a programmable gate array(s)(PGA), a field programmable gate array (FPGA), etc.

Any process descriptions or blocks in flow charts should be understoodas representing modules, segments, or portions of code which include oneor more executable instructions for implementing specific logicalfunctions or steps in the process, and alternate implementations areincluded within the scope of the preferred embodiment of the presentinvention in which functions may be executed out of order from thatshown or discussed, including substantially concurrently or in reverseorder, depending on the functionality involved, as would be understoodby those reasonably skilled in the art of the present invention.

The email application, which comprises an ordered listing of executableinstructions for implementing logical functions, can be embodied in anycomputer-readable medium for use by or in connection with an instructionexecution system, apparatus, or device, such as a computer-based system,processor-containing system, or other system that can fetch theinstructions from the instruction execution system, apparatus, or deviceand execute the instructions. In the context of this document, a“computer-readable medium” can be any means that can contain, store,communicate, propagate, or transport the program for use by or inconnection with the instruction execution system, apparatus, or device.The computer-readable medium can be, for example but not limited to, anelectronic, magnetic, optical, electromagnetic, infrared, orsemiconductor system, apparatus, device, or propagation medium. Morespecific examples (a nonexhaustive list) of the computer-readable mediumwould include the following: an electrical connection (electronic)having one or more wires, a portable computer diskette (magnetic), arandom access memory (RAM) (electronic) a read-only memory (ROM)(electronic), an erasable programmable read-only memory (EPROM or Flashmemory) (electronic), an optical fiber (optical), and a portable compactdisc read-only memory (CDROM) (optical). Note that the computer-readablemedium could even be paper or another suitable medium upon which theprogram is printed, as the program can be electronically captured, viafor instance optical scanning of the paper or other medium, thencompiled, interpreted or otherwise processed in a suitable manner ifnecessary, and then stored in a computer memory.

Although exemplary embodiments have been shown and described, it will beclear to those of ordinary skill in the art that a number of changes,modifications, or alterations may be made, none of which depart from thespirit of the present invention. For example, while the determination ofthe originating IP address and the determination of the email attributesare shown as separate and sequential steps, it should be appreciatedthat these steps may occur substantially simultaneously. Alternatively,these steps may be performed in reverse order such that the attributesare compared prior to determining the originating IP address of theemail message. Moreover, while certain embodiments show the email clientas filtering email messages for origin from an undesired geographicregionation, the filtering process may be implemented at the serverlevel, thereby filtering email messages prior to conveying them to theemail client. All such changes, modifications, and alterations shouldtherefore be seen as within the scope of the present invention.

1. A communication system comprising: a receiver configured to receivean email message, the email message being received from a sendingdomain, the email message comprising a sending Internet Protocol (IP)address, the sending IP address being indicative of the sending domain;a first data storage component including at least one undesirable IPaddress previously determined to be associated with an undesirablegeographic location; a first filter configured to extract the sending IPaddress from the received email message; and compare logic configured tocompare the extracted sending IP address with the at least oneundesirable IP address in the first data storage component to determinewhether the sending IP address corresponds to a domain from an undesiredgeographic location.
 2. The system of claim 1, wherein the sending IPaddress is associated with a creator of the received email message. 3.The system of claim 1, wherein the sending IP address is associated withan intermediary that received the email message from a creator of theemail message.
 4. The system of claim 1, further comprising: deletelogic configured to delete the email message in response to determiningthat the sending IP address corresponds to a domain from an undesiredgeographic location.
 5. The system of claim 1, further comprising: meansfor deleting the email message in response to determining that thesending IP address corresponds to a domain from an undesired geographiclocation.
 6. The system of claim 1, further comprising: a second datastorage component, the second data storage component including a list ofdesired email attributes.
 7. The system of claim 1, wherein the list ofdesired email attributes in the second data storage component comprisesan attribute selected from at least one of the following: a desired IPaddress; a sender email address; an email subject line; and a contenttype.
 8. The system of claim 7, further comprising: a second filterconfigured to extract email attributes from the received email message;compare logic configured to compare the extracted attributes with thelist of desired email attributes to determine whether any of theextracted attributes coincides with any of the desired email attributesin the second data storage component; and delete logic configured todelete the email message in response to determining that the sending IPaddress corresponds to a domain from an undesired geographic locationand that none of the extracted attributes coincides with any of thedesired email attributes in the second database.
 9. A communicationmethod comprising: receiving an email message, the email message beingreceived from a first Internet Protocol (IP) address; extracting thefirst IP address from the email message; and comparing the first IPaddress to a list including at least one undesirable IP addresspreviously determined to be associated with an undesirable geographiclocation to determine whether the extracted IP address is associatedwith an undesirable geographic location.
 10. The method of claim 9,wherein the first IP address is associated with an intermediary thatreceived the email message from a creator of the email message.
 11. Themethod of claim 9, wherein extracting the first IP address from theemail message comprises: extracting the first IP address from a headerof the email message.
 12. The method of claim 9, wherein extracting thefirst IP address from the email message comprises: extracting an IPaddress from a body of the email message.
 13. The method of claim 12,further comprising: deleting the email message in response todetermining that the extracted first IP address is associated with anundesirable geographic location.
 14. The method of claim 12, whereindeleting the email message comprises permanently removing the emailmessage.
 15. The method of claim 12, wherein deleting the email messagecomprises storing the email message in a designated folder.
 16. Themethod of claim 12, wherein deleting the email message comprises markingthe email message for followup.
 17. The method of claim 9, furthercomprising: extracting email attributes from the received email message;comparing the extracted attributes with a predefined list of desiredemail attributes to determine whether any of the extracted emailattributes coincides with any of the desired email attributes; deletingthe email message in response to determining that the first IP addressis associated with an undesirable geographic location and that none ofthe extracted attributes coincides with any of the desired emailattributes.
 18. A computer-readable storage medium comprising:computer-readable code adapted to instruct a programmable device toreceive an email message, the email message being received from sendingInternet protocol (IP) address; computer-readable code adapted toinstruct a programmable device to extract the sending IP address fromthe email message; and computer-readable code adapted to instruct aprogrammable device to compare the sending IP address to a listincluding at least one undesirable IP address, previously determined tobe associated with an undesirable geographic location, to determinewhether the extracted IP address is associated with an undesirablegeographic location.
 19. The computer readable storage medium of claim18, wherein the sending IP address is associated with an intermediarythat received the email message from a creator of the email message. 20.The computer-readable storage medium of claim 18, further comprising:computer-readable code adapted to instruct a programmable device toextract email attributes from the received email message;computer-readable code adapted to instruct a programmable device tocompare the extracted attributes with a predefined list of desired emailattributes to determine whether any of the extracted email attributescoincides with any of the desired email attributes; andcomputer-readable code adapted to instruct a programmable device todelete the email message in response to determining that the sending IPaddress is associated with an undesirable geographic location and thatnone of the extracted attributes coincides with any of the desired emailattributes.